Technical information
Malicious functions:
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 5b5fadb####.s.a####.ir:80
- TCP(TLS/1.0) onesi####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- 5b5fadb####.s.a####.ir
- and####.cli####.go####.com
- onesi####.com
HTTP GET requests:
- 5b5fadb####.s.a####.ir/adview/?car=####&adadversion=####&model=####&andr...
Modified file system:
Creates the following files:
- /data/data/####/ADAD_PREF.xml
- /data/data/####/OneSignal.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/ADID.txt
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
